Issues getting PagerDuty which uses SAML 2.0 to talk to Shibboleth IDP.

Cahill, Charles (GE Appliances) Charles.Cahill at ge.com
Wed Jul 8 14:54:05 EDT 2015 

I am still struggling with getting Pager Duty to talk to my Shibboleth IDP via a SAML 2.0 communication path.
I have made all of the changes Peter suggested and here is the current error I am getting.  Can anyone please help
me figure this out.  I would love to see our business utilizing this software for 3rd party authentication.

Jul 07, 2015 4:01:05 PM org.apache.catalina.core.StandardWrapperValve invoke
INFO: 16:01:05.574 [http-bio-8080-exec-7] TRACE e.i.m.s.idp.session.IdPSessionFilter - Attempting to retrieve IdP session cookie.
16:01:05.575 [http-bio-8080-exec-7] INFO  Shibboleth-Access - 20150707T200105Z|3.101.113.148|3.101.113.148:80|/profile/SAML2/Redirect/SSO|
16:01:05.575 [http-bio-8080-exec-7] INFO  Shibboleth-Access - 20150707T200105Z|3.101.113.148|3.101.113.148:80|/profile/SAML2/Redirect/SSO|
16:01:05.575 [http-bio-8080-exec-7] DEBUG e.i.m.s.i.p.IdPProfileHandlerManager - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/Redirect/SSO
16:01:05.575 [http-bio-8080-exec-7] DEBUG e.i.m.s.i.p.IdPProfileHandlerManager - shibboleth.HandlerManager: Located profile handler of the following type for the request path: edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler
16:01:05.575 [http-bio-8080-exec-7] DEBUG e.i.m.s.idp.util.HttpServletHelper - LoginContext key cookie was not present in request
16:01:05.575 [http-bio-8080-exec-7] DEBUG e.i.m.s.i.p.saml2.SSOProfileHandler - Incoming request does not contain a login context, processing as first leg of request
16:01:05.575 [http-bio-8080-exec-7] DEBUG e.i.m.s.i.p.saml2.SSOProfileHandler - Decoding message with decoder binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
16:01:05.575 [http-bio-8080-exec-7] DEBUG o.o.w.m.decoder.BaseMessageDecoder - Beginning to decode message from inbound transport of type: org.opensaml.ws.transport.http.HttpServletRequestAdapter
16:01:05.575 [http-bio-8080-exec-7] DEBUG o.o.s.b.d.HTTPRedirectDeflateDecoder - Decoded RelayState: ruby-saml
16:01:05.575 [http-bio-8080-exec-7] DEBUG o.o.s.b.d.HTTPRedirectDeflateDecoder - Base64 decoding and inflating SAML message
16:01:05.576 [http-bio-8080-exec-7] DEBUG o.o.w.m.decoder.BaseMessageDecoder - Parsing message stream into DOM document
16:01:05.578 [http-bio-8080-exec-7] ERROR o.o.w.m.decoder.BaseMessageDecoder - Encountered error parsing message into its DOM representation
org.opensaml.xml.parse.XMLParserException: Unable to read XML from input stream
	at org.opensaml.xml.parse.StaticBasicParserPool.parse(StaticBasicParserPool.java:239) ~[xmltooling-1.4.5.jar:na]
	at org.opensaml.ws.message.decoder.BaseMessageDecoder.unmarshallMessage(BaseMessageDecoder.java:186) [openws-1.5.5.jar:na]
	at org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:102) [opensaml-2.6.5.jar:na]
	at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:79) [openws-1.5.5.jar:na]
	at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70) [opensaml-2.6.5.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:386) [shibboleth-identityprovider-2.4.4.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211) [shibboleth-identityprovider-2.4.4.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.4.4.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.4.jar:na]
	at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.4.jar:na]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:727) [servlet-api.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303) [catalina.jar:7.0.59]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.59]
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) [tomcat7-websocket.jar:7.0.59]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.59]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.59]
	at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.4.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.59]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.59]
	at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) [shibboleth-identityprovider-2.4.4.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.59]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.59]
	at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.4.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.59]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.59]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:203) [catalina.jar:7.0.59]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) [catalina.jar:7.0.59]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:504) [catalina.jar:7.0.59]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170) [catalina.jar:7.0.59]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) [catalina.jar:7.0.59]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) [catalina.jar:7.0.59]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:421) [catalina.jar:7.0.59]
	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1074) [tomcat-coyote.jar:7.0.59]
	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611) [tomcat-coyote.jar:7.0.59]
	at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:314) [tomcat-coyote.jar:7.0.59]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [na:1.7.0_75]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [na:1.7.0_75]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-coyote.jar:7.0.59]
	at java.lang.Thread.run(Thread.java:745) [na:1.7.0_75]
Caused by: java.util.zip.ZipException: invalid code lengths set
	at java.util.zip.InflaterInputStream.read(InflaterInputStream.java:164) ~[na:1.7.0_75]
	at java.util.zip.InflaterInputStream.read(InflaterInputStream.java:122) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.impl.XMLEntityManager$RewindableInputStream.read(XMLEntityManager.java:2889) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.impl.XMLEntityManager.setupCurrentEntity(XMLEntityManager.java:670) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.impl.XMLVersionDetector.determineDocVersion(XMLVersionDetector.java:189) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:812) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:777) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.java:141) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:243) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderImpl.parse(DocumentBuilderImpl.java:347) ~[na:1.7.0_75]
	at javax.xml.parsers.DocumentBuilder.parse(DocumentBuilder.java:121) ~[na:1.7.0_75]
	at org.opensaml.xml.parse.StaticBasicParserPool$DocumentBuilderProxy.parse(StaticBasicParserPool.java:673) ~[xmltooling-1.4.5.jar:na]
	at org.opensaml.xml.parse.StaticBasicParserPool.parse(StaticBasicParserPool.java:234) ~[xmltooling-1.4.5.jar:na]
	... 38 common frames omitted
16:01:05.580 [http-bio-8080-exec-7] WARN  e.i.m.s.i.p.saml2.SSOProfileHandler - Error decoding authentication request message
org.opensaml.ws.message.decoder.MessageDecodingException: Encountered error parsing message into its DOM representation
	at org.opensaml.ws.message.decoder.BaseMessageDecoder.unmarshallMessage(BaseMessageDecoder.java:209) ~[openws-1.5.5.jar:na]
	at org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:102) ~[opensaml-2.6.5.jar:na]
	at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:79) ~[openws-1.5.5.jar:na]
	at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70) ~[opensaml-2.6.5.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:386) [shibboleth-identityprovider-2.4.4.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211) [shibboleth-identityprovider-2.4.4.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.4.4.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.4.jar:na]
	at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.4.jar:na]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:727) [servlet-api.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303) [catalina.jar:7.0.59]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.59]
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) [tomcat7-websocket.jar:7.0.59]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.59]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.59]
	at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.4.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.59]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.59]
	at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) [shibboleth-identityprovider-2.4.4.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.59]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.59]
	at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.4.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.59]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.59]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:203) [catalina.jar:7.0.59]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) [catalina.jar:7.0.59]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:504) [catalina.jar:7.0.59]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170) [catalina.jar:7.0.59]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) [catalina.jar:7.0.59]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) [catalina.jar:7.0.59]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:421) [catalina.jar:7.0.59]
	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1074) [tomcat-coyote.jar:7.0.59]
	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611) [tomcat-coyote.jar:7.0.59]
	at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:314) [tomcat-coyote.jar:7.0.59]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [na:1.7.0_75]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [na:1.7.0_75]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-coyote.jar:7.0.59]
	at java.lang.Thread.run(Thread.java:745) [na:1.7.0_75]
Caused by: org.opensaml.xml.parse.XMLParserException: Unable to read XML from input stream
	at org.opensaml.xml.parse.StaticBasicParserPool.parse(StaticBasicParserPool.java:239) ~[xmltooling-1.4.5.jar:na]
	at org.opensaml.ws.message.decoder.BaseMessageDecoder.unmarshallMessage(BaseMessageDecoder.java:186) ~[openws-1.5.5.jar:na]
	... 37 common frames omitted
Caused by: java.util.zip.ZipException: invalid code lengths set
	at java.util.zip.InflaterInputStream.read(InflaterInputStream.java:164) ~[na:1.7.0_75]
	at java.util.zip.InflaterInputStream.read(InflaterInputStream.java:122) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.impl.XMLEntityManager$RewindableInputStream.read(XMLEntityManager.java:2889) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.impl.XMLEntityManager.setupCurrentEntity(XMLEntityManager.java:670) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.impl.XMLVersionDetector.determineDocVersion(XMLVersionDetector.java:189) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:812) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:777) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.java:141) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:243) ~[na:1.7.0_75]
	at com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderImpl.parse(DocumentBuilderImpl.java:347) ~[na:1.7.0_75]
	at javax.xml.parsers.DocumentBuilder.parse(DocumentBuilder.java:121) ~[na:1.7.0_75]
	at org.opensaml.xml.parse.StaticBasicParserPool$DocumentBuilderProxy.parse(StaticBasicParserPool.java:673) ~[xmltooling-1.4.5.jar:na]
	at org.opensaml.xml.parse.StaticBasicParserPool.parse(StaticBasicParserPool.java:234) ~[xmltooling-1.4.5.jar:na]
	... 38 common frames omitted
16:01:05.581 [http-bio-8080-exec-7] DEBUG e.i.m.s.idp.util.HttpServletHelper - LoginContext key cookie was not present in request
16:01:05.581 [http-bio-8080-exec-7] DEBUG e.i.m.s.idp.ui.ServiceContactTag - No relying party, nothing to display

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Thursday, June 11, 2015 8:20 PM
To: users at shibboleth.net
Subject: Re: Re: Re: Issues getting PagerDuty which uses SAML 2.0 to talk to Shibboleth IDP.

Short version:
Everything in
https://urldefense.proofpoint.com/v2/url?u=http-3A__shibboleth.net_pipermail_users_2015-2DJune_021856.html&d=AwICAg&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=Ay4xjbXoe6YvlvYwTANr9ZsOm6cEXvasE-gwLIuoyN8&m=Vzx2Oscd0HzB08EwM1hc79zp2Nmpf4Z6nJrlz9Sxigs&s=cp5QJ7rz0Mpzf6WHM2-PVujYTLw75L2gQ3QIEVorLhU&e=
still applies. I created the metadata for you, the required relying party entry to disable encryption and prefer email NameID format over others, the attribute resolver (based on examples you sent) and the attribute filter.
The only thing I didn't spoon-feed you was the MetadataProvider that makes sure the metadata I created for you was actually processed though Kevin sent you an example:
https://urldefense.proofpoint.com/v2/url?u=http-3A__shibboleth.net_pipermail_users_2015-2DJune_021838.html&d=AwICAg&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=Ay4xjbXoe6YvlvYwTANr9ZsOm6cEXvasE-gwLIuoyN8&m=Vzx2Oscd0HzB08EwM1hc79zp2Nmpf4Z6nJrlz9Sxigs&s=DGWipxYRt5dvZ9KCCCLzM4iZFkVur-Lz2a9IZU9ylTc&e=
and I recall you said you added it to a file that already contained others. Impossible for us to know, of course.

The only thing we have not made any progress on in this entire thread is getting you to make your IDP load SAML metadata for a single SP.
So that's the only thing I want to hear about from you now.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

More information about the users mailing list